事件日志。卸载事件消息文件 (DLL)
我安装 NT 服务并将有关“message.dll”文件的信息添加到 EvenLog 的注册表中。 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\MyApp EventMessageFile = C:\message.dll
启动服务并在 EventLog 查看器中查看服务的日志信息消息。 工作正常。
接下来，卸载服务并尝试删除 message.dll 文件。 失败的！我收到“拒绝访问”消息框，因为此 DLL 已加载。
我的问题：在我的情况下，如何正确删除/卸载/卸载 message.dll？
多谢， 德米特里
I install NT service and add info about 'message.dll' file into registry for EvenLog.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\MyApp
EventMessageFile = C:\message.dll
Start service and view service's logging info messages in EventLog viewer.
Works fine.
Next, uninstall service and try to remove message.dll file.
Failed! I receive 'Access deny' messagebox because this DLL is loaded.
My question: How can I properly remove/unload/uninstall message.dll in my case?
Thanks a lot,
Dmitry
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
卸载之前是否停止服务？在卸载服务之前您是否关闭了EventLog查看器？这是两个典型错误，如果 message.dll 继续使用，可能会出现这些错误。
如果您仍然遇到问题，我建议您使用 Process Explorer 来找到正在使用的dll的进程。 Ctrl + F或菜单“查找”/“查找句柄或DLL...”可以用来查找进程使用的DLL。
Do you stop your service before uninstall it? Do you close EventLog viewer before uninstall your serive? These are two typical errors which can follow that the message.dll stay in use.
If you will have the problem after all I would you recommend to use Process Explorer to find the process which hold the dll in use. Ctrl + F or menu "Find" / "Find Handle or DLL..." can be used to find processes used the DLL.
Windows 事件查看器使 dll 保持打开状态以读取消息。
然而，这并不是唯一可能读取事件日志的东西。 RMM 软件（例如 ConnectWise、Naverisk 等）也会监视事件日志，并可以防止您的软件升级锁定的
EventMessageFiledll 文件。当涉及第三方软件时，仅像接受的答案中那样关闭 MMC.exe 是不可行的。
我找到了两种解决方法：
停止使用
EventMessageFile系统，只使用内置的 EventCreate.exe 作为源使用重新启动管理器子系统主动重新启动第三方 RMM 服务，如 Windows 事件查看器锁定了我的 EXE 文件
The Windows Event Viewer holds the dll open for reading messages.
However - it's not the only thing that may be reading the Event Log. RMM software such as ConnectWise, Naverisk etc also monitor the event log, and can prevent your software from upgrading a locked
EventMessageFiledll file.When third-party software is involved it's not feasible to just close MMC.exe as in the accepted answer.
I have found two workarounds for this:
Stop using the
EventMessageFilesystem and just use the built-in EventCreate.exe as the source insteadUse the Restart Manager subsystem to agressively restart the third-party RMM service, as discussed in Windows Event Viewer holds a lock on my EXE file